Exploit DB 10999 / Bugtraq 37610 concern a file inclusion
vulnerability in w-agora 4.2.1 and include the following PoC:
http://127.0.0.1/w-agora/rss.php?site=http127001wagora&bn=http://127.0.0.1/c.txt
?
Here's the code from the affected file, as included in the
distribution file included with the Exploit DB advisory:
----- snip, snip, snip -----
$bn = preg_replace("/[^a-zA-Z0-9_]/", "", getFormVar('bn'));
$site = preg_replace("/[^a-zA-Z0-9_]/", "", getFormVar('site'));
...
if (empty ($bn) ) {
$site = basename($site);
include ("$cfg_dir/site_${site}.$ext");
} else {
$bn = basename($bn);
include ("$cfg_dir/$bn.$ext");
}
----- snip, snip, snip -----
[There are two calls before this snippet to 'include()', but tracing
through those, I don't see any place where the 'bn' parameter could be
used to include PHP code.]
The preg_replace() calls sanitize '$bn' and '$site' by removing any
characters that aren't alphanumeric or an underscore so I don't see
how indoushka's PoC can work. Nor do I see how this could be a
*remote* file include attack, as the PoC suggests and SecurityFocus
claims.
George
--
theall at tenablesecurity.com